Get anomaly records for an anomaly detection job

POST also GET /_ml/anomaly_detectors/{job_id}/results/records

Records contain the detailed analytical results. They describe the anomalous activity that has been identified in the input data based on the detector configuration. There can be many anomaly records depending on the characteristics and size of the input data. In practice, there are often too many to be able to manually process them. The machine learning features therefore perform a sophisticated aggregation of the anomaly records into buckets. The number of record results depends on the number of anomalies found in each bucket, which relates to the number of time series being modeled and the number of detectors.

Required authorization

Cluster privileges: monitor_ml

Path Parameters

job_id string Id required: Identifier for the anomaly detection job.

An example body for a GET _ml/anomaly_detectors/low_request_rate/results/records request.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST _ml/anomaly_detectors/low_request_rate/results/records
{
  "sort": "record_score",
  "desc": true,
  "start": "1454944100000"
}

JavaScript Elasticsearch JavaScript Client

const response = await client.ml.getRecords({
  job_id: "low_request_rate",
  sort: "record_score",
  desc: true,
  start: 1454944100000,
});

Python Elasticsearch Python Client

resp = client.ml.get_records(
    job_id="low_request_rate",
    sort="record_score",
    desc=True,
    start="1454944100000",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_ml/anomaly_detectors/low_request_rate/results/records" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "sort": "record_score",
    "desc": true,
    "start": "1454944100000"
  }'

Java Elasticsearch Java Client

client.ml().getRecords(g -> g
    .desc(true)
    .jobId("low_request_rate")
    .sort("record_score")
    .start(DateTime.of("1454944100000"))
);

C# Elasticsearch .NET Client

var response = await client.MachineLearning
    .GetRecordsAsync(jobId: "low_request_rate", d1 => d1
        .Desc(true)
        .Sort(x => x.RecordScore)
        .Start(DateTimeOffset.Parse("2016-02-08T15:08:20.0000000+00:00", CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind))
    );

PHP Elasticsearch PHP Client

$resp = $client->ml()->getRecords([
    "job_id" => "low_request_rate",
    "body" => [
        "sort" => "record_score",
        "desc" => true,
        "start" => "1454944100000",
    ],
]);

Ruby Elasticsearch Ruby Client

response = client.ml.get_records(
  job_id: "low_request_rate",
  body: {
    "sort": "record_score",
    "desc": true,
    "start": "1454944100000"
  }
)

Response

No example

Required authorization

Path Parameters

Query Parameters { desc , end , exclude_interim , from , record_score , size , sort , start , }

Request { desc , end , exclude_interim , page , record_score , sort , start , }

Response

Query Parameters

Request